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INTRODUCTION 


This memorandum announces the creation of a Privacy and Data Access Office (PDAO) 
serving the entire Department, comprised of four staff members. The goal of this 
reconfiguration is to improve the administration of DPH privacy, data access and research 
review through increased visibility, coordination, efficiency, and compliance. It will also reduce 
confusion by establishing clear lines of responsibility for these DPH-wide functions and permit 
the standardization and coordination of data access processes. DPH collects and works with 
an enormous amount of confidential data. Data are a vital component of the work at DPH and 
are widely sought. Increases in internal and external requests for DPH data as well as the 
growth of electronic systems require that the Department focus more attention on and allocate 
additional resources to an office that ensures appropriate and timely access, while at the same 
time protects its confidential data from unauthorized use or disclosure. The competing 
demands of our public health responsibilities and the daunting prospect of a privacy or security 
breach require increased attention to this delicate balance. Achieving and maintaining this 
balance requires strong support from the Commissioner’s office and recognition and promotion 
by all senior staff of the importance of measures instituted to ensure access to DPH data, while 
safeguarding privacy. The formation and support of the PDAO is necessary to integrate privacy 
and data access processes into the regular fabric of our public health work and to boost their 
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profile within the Department. Far too often these issues are an afterthought and thus a 
source of contention, rushed forward without adequate thought, context or planning. This 
office will ensure that privacy and confidentiality are not seen as barriers to data access, but 
timely considered and an important protection for us all. 

The PDAO will report jointly to the Deputy Commissioner and the General Counsel. The core 
of the office is a consolidation of three current staff positions and the addition of an 
administrative position. Tracy Miller, a Senior Deputy General Counsel and former Privacy 
Officer, will direct the office. She will supervise the Data Access Coordinator (DAC), Alice 
Mroszczyk, and the Privacy Officer, Eric Rubinstein. The addition of an administrative 
assistant is critical to reduce backlogs in certain areas and to improve the administration of 
existing and proposed functions explained more fully below. Bill Anderson will be working with 
the office in an administrative capacity. This team constitutes an extremely well-balanced 
group with varied backgrounds in privacy work including legal, epidemiological, programmatic, 
administrative, and systems skills in addition to a thorough knowledge of the entire 
department. The team can successfully implement these goals, provided that it is given 
sufficient resources and recognition. With the transition to a new Privacy Officer and the 
recognized need for administrative support it is a natural time to form this office and support 
this initiative. 

A second Department-wide area, Technical Peer Review, will be coordinated with the 
Commissioner’s Policy Review in the Commissioner’s Office and report to the Deputy 
Commissioner. These functions previously were housed in two separate areas of the 
Department, the Commissioner’s Office and CHISRE. A new PC I, working in the 
Commissioner’s office will be responsible for the administration of the coordinated review 
processes. 

I. PRIVACY AND DATA ACCESS OFFICE: 

Goals: 

• Create one office in the Department where individuals within and outside the 
Department know they can turn for information about and access to data. 

o Reduce confusion, 
o Improve communication. 

o Create greater consistency in application of standards, 
o Respond to changing needs regarding data access and electronic systems, 
o Highlight department-wide role and spread administrative cost department-wide 
through Center assessments. 

o Serve as the contact point for the new EOHHS Data Sharing MOU 

• Reduce backlog and improve efficiency. 

o Reduce or eliminate redundancy through consolidation of functions in one office, 
o Address the backlog in RaDAR and Limited Data Set applications, 
o Accelerate review process for internal and external data requests and data use 
agreements. 
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o Provide administrative support for the Human Research Review Committee 
(HRRC - the DPH IRB at the Shattuck Hospital) and coordinate overlapping 
functions between the HRRC and RaDAR. 

• Increase visibility and highlight the importance of these functions through 
Commissioner’s office support and additional resources for the PDAO. 

o Recognize and promote its Department-wide functions, 
o Require Centers to utilize the PDAO for among other things, accessing and 
sharing data to ensure consistent standards and Department-wide participation, 
o Provide sufficient resources with the burden allocated across the Department. 

Build on the Quality of Existing Processes: 

• RaDAR is an excellent model; held out as a standard for other states. 

• RaDAR and HRRC both have strong processes. Coordination will enhance them. 

• The Confidentiality Policy and Procedures are well developed. 

o Require little revision at this juncture. 

o Require increased visibility through recognition by Senior Staff, additional training 
and compliance checks. 

• Frameworks are in place. 

o Require a tight and efficient administrative structure with sufficient support, 
resources and recognition to successfully move forward. 

• Privacy Liaison structure in place. 

o Works very well with respect to some centers and needs to be strengthened in 
other areas. 

• Good rapport with the EOHHS privacy group, which will continue and likely expand. 

• Web pages on DPH and HealthNet sites provide a good base for dissemination of 
information. 

o Regular and targeted updates provide an effective mechanism for training and 
dissemination of information and forms. 

Potential Risks of Inadequate Resources: 

• Breach of confidentiality by staff that are insufficiently aware of obligations or 
importance of procedures. 

• Damage to the integrity of DPH as a resource for research data due to delays in acting 
on applications to RaDAR. 

• Inconsistent application of standards. 

• Violation of state or federal laws. 

• Delays in processing requests for data within DPH, which damages the integrity of the 
process and increases risk of a breach. 

o Missing or delayed data required for program evaluation, 
o Missing or delayed data requested by EOHHS or Governor’s office, 
o Loss of federal funds. 

o Release of data without appropriate agreement(s). 
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Issues to be Addressed: 


• Lack of awareness or acknowledgement of functions of the Privacy Officer and the Data 
Access Coordinator. 

• Insufficient resources. 

• Long timelines for RaDAR and data use agreements. 

• Inconsistent awareness and application of MDPH Confidentiality Policy and Procedures. 

• Dissension among centers with respect to requirements for data access. 

• Overlap among current positions leads to duplication of efforts or gaps and confusion 
among workforce regarding which position is responsible for specific tasks. 

• Increased demand for data access, sharing, and linkage to meet federal reporting 
standards, for program evaluation and to target resources. 

• Inadequate resources on website and intranet for use by consumers of HRRC, RaDAR, 
and Data Use Agreements. 

• Inadequate privacy and data access resources for the development of complex 
electronic reporting systems. 

Requirements: 

• Recognition of importance of functions by the Commissioner’s Office and the Executive 
Team and on-going support and promotion of these functions. 

• Consolidation of staff and functions in one office. 

• Additional staff and resources. 

II. POLICY AND TECHNICAL PEER REVIEW 


Goals : 

• Create a seamless process in which one central office administers and coordinates the 
two separate but related review processes, peer review and policy review, to ensure 
that all reports and publications issued by the Department are appropriately reviewed 
prior to release. 

o Reduce confusion 

o Create greater consistency in application of standards 
o Create a complete record of all reports 

o Create a process that tracks internal and external as well as journal peer review 
processes 

• Reduce backlog and improve efficiency 

o Standardized procedures and forms will improve efficiency 
o Well publicized standards and procedures will improve response time 
o Designated administrative personnel responsible for process will improve 
efficiency 

o Recruitment of additional reviewers will improve response time 

• Increase visibility and highlight importance of the review functions by consolidating them 
in the Commissioner’s Office and emphasizing their Department-wide nature. 
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Build on the Quality of the Existing Process : 

• The peer and policy review frameworks are in place and require only minimal 
modification to ensure that publications authored by DPH staff meet high professional 
standards and are consistent with DPH and administration policy. 

• Alternate external peer review processes will be recognized and centrally tracked 

Potential Risks of Inadequate Resources : 

• Release of poor quality or delayed reports or reports contrary to Department or 
administration policies. 

• Inadequate or no review of some reports. 

• Review of reports pursuant to different standards. 

• No coordination between the two processes, resulting in delays or reports that are 
released without completing one or both of the review processes. 

• Continued failure to recruit adequate reviewers which slows down the process. 

Issues to be Addressed : 

• Lack of coordination between technical and policy reviews. 

• Lack of central repository. 

• Delays due to inadequate reviewers, absence of dedicated administrative coordinator, 
and lack of coordination between processes. 

• Lack of communication of requirements. 

• Insufficient reviewers. 

• Inconsistent participation and application of standards. 


Attachments: Organizational Charts 
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